Google has agreed to anonymize its log files after 18 months in response to …

Google has agreed to change its policy on retaining server logs after inquiries from Europe's Article 29 Working Group. That group, which represents data privacy officers from many European countries, asked Google for more information about its privacy policies, and Norway wasn't keen on Google's plans, either. Google has responded by dropping the amount of time it hangs onto personalized logs to 18 months.

Google had previously committed to anonymize (but not delete) its server logs after 18-24 months. Now, in a letter sent to the Working Group, the company pledges to anonymize the data after 18 months, though it cautions that future legislation may require it to store the data for longer. Under Google's plan, the logs would be kept, but the IP addresses (probably just the last octet, though no final decision has yet been made) would be scrambled permanently; not even Google could gain access to the original information.

Peter Fleischer, Google's global privacy counsel, said in the letter that Google was actually behaving better than most players in the industry. "Indeed, to our knowledge," he wrote, "most Internet companies retain logs for far longer than Google—in many cases, indefinitely." Actually, nothing that Google has said indicates that they won't also keep log files indefinitely; logs will simply be anonymized for long-term storage.

In defending its initial plan to keep personal information for up to two years, Google pointed out that the US Department of Justice has called for a 24-month data retention period—though no legislation to this effect has been passed. In Europe, the Data Retention Directive requires all EU member states to pass data protection legislation by 2009, though the maximum term for data retention can vary from six to 24 months. Fleischer notes that "there seems to be an emerging international consensus on 24 months as the outer limit for data retention."

When Google finally does start anonymizing logs (technical details are still being worked out), the process will be both permanent and retroactive. Anyone who used Google to search for "Jetsons porn" back in 2003 can soon rest easy.